Simply Solving Cyber - Mitch Parker

Welcome or welcome back to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Teddy Guzik.

And we would like to thank you for joining us again for the 5th episode of Simply Solving Cyber. Today we're going to be talking to Mitch Parker, the CISO of IU Health in Indianapolis, Indiana. More on that here in a bit. But speaking of healthcare, And, you know, here at the, where I was gonna say the end of the pandemic, but I don't think anybody can say that, unfortunately. But yeah, a lot of change in the last 6 months. Definitely the world went through a bit of a shock and change in business and the economy. Teddy, what are you seeing? What are you feeling from this point?

So I feel like we're starting to see some companies start to go back to work. It's going to be interesting to see how that affects security posture. And all these people have started or transitioned into fully remote and everything there, but then now we're starting to bring them back. So how are we going to continue on with the security for the remote working and then also the on-premise people working in the office type of stuff too?

Yeah.

And from a healthcare standpoint, since we're going to be talking to Mitch here in a few, you've done a lot of pen tests over the last 4 or 5 years. What, what do you typically see at hospitals? I mean, quickly, before you answer that, from my perspective, a lot of hospitals are underfunded, a lot of priorities that they're trying to manage. Cyber is not always where it needs to be. I think that market, that sector is starting to catch up, but definitely a lot of opportunity to improve? What's your perspective?

Yeah, yeah. So I mean, I think the main thing is operations comes first, and there's not a lot of room for error in terms of how can we improve our security posture here. So to answer your question about how pen tests have gone in the past at hospitals and health networks and stuff like that, usually, you know, you can find a lot of holes there. They do seem to be underfunded like you had mentioned, there's a large— there's a risk to fixing and to changing anything in their network from an operations standpoint. So a lot of hesitation and to be a little bit more risk-averse to that kind of stuff.

Yeah, no, that's a fair point. Well, Mitch, who we're going to be talking to, is pretty renowned in the healthcare space. He does a lot of speaking at various healthcare associations and cyber-specific forums on healthcare. So we're looking forward to talking to him. All right. We'd like to now welcome Mitch Parker, the CISO of IU Health, to the show. Mitch, thanks for joining us.

Thanks for having me today.

Awesome. So Mitch, we want to get to know you a little bit more and hear your story, how you got into cyber, what you've done over the years and what you're doing now. And then we'll, we'll, we'll get into some more questions, but really want to start with getting to know you.

Absolutely. So where would you like me to begin? IT or cybersecurity?

Well, so maybe start with IT and how that segued into cybersecurity. Give us how you made that career shift and journey into cyber.

So I can tell you, I started off in the late '90s. I am a failed help desk technician.

This sounds like a good story forthcoming. I like this.

Yeah, I'm failed tech support, failed help desk. So didn't do good at either of those. 2 months into a job at tech support, I got let go. And I answered an ad on Usenet back before Usenet was something other than something used to trade pirate materials. So I answered this ad looking for Java developers because I actually had a Java class in my undergraduate. And this was in 1997. So almost no one knew Java. I ended up taking this consulting job that involved me rewriting an application in Java that was done by a consulting firm for a human resources management firm to help them do compensation analysis. Okay. And I started building on project after project with this company, and this company grew to about 50 people and was doing a lot of in-house development. 9/11 hit and the economy went completely downhill.

Right.

And this consulting firm that at one time employed 50 people had less than half that workforce there. And we were all forced to look for outside jobs, aka the big consulting contracts ended. We were pretty much taking what we could get.

Got it.

And I ended up working for a defense contractor. And one of the things I was doing there was doing software configuration management. But I had a bit of a security background because I had been doing security work at this consulting firm, at least locking down the applications that we were developing and putting some modicum of security in place because of the requirements that our customers had. I had at least one of them being Big Pharma, you had to make sure security was good because if it wasn't, the architect said no and you didn't get paid.

I was going to say that whole validation space and GxP compliance, definitely in pharma, that drives a lot of security by design, which is, I think, a good thing.

Absolutely. So what ended up happening is DOD around that time started releasing this thing called the Security Technical Implementation Guide. And people figured out I really knew how to implement them well. So I went from just being an Oracle DBA there and doing database work to doing lots and lots of work on how to secure databases. And then from there, how to secure Windows and how to secure other things. And in 2003, I made the transition from being a database person to a security person.

Okay.

And at the same time, I had another customer that was— I was doing a lot of web and database work for that wanted to stand up their own web servers. So I went from doing web and database work for them to doing security work for them as well.

So was that an intention? Was that an intentional thing? Did you see security as an unmet need and say, I'm going to make this pivot, or was it more of just the project work and the work in front of you led you into that course?

I would say the latter. Okay. And I ended up working security full-time later half of 2003, started doing a lot of work in DFIR and investigations as well to go along with it, and was on that path for about 5 years until my DOD contract ended in 2008. Then I jumped over to my biggest customer, who was Temple University Health System, to do security work full-time as a contractor. Okay. And while that was happening, I was actually interviewing for a job there. I was interviewing for their chief architect job in their infrastructure team. And the person that ran infrastructure and security there resigned the day of my second interview. Hmm. So it was pretty funny. I was doing that. I was applying for a government job at the same time doing information assurance and had a choice to make.

Right.

Well, the choice was pretty easy because government came back and offered me a lot less money than they had initially said in their offer letter.

Sounds classic.

Usually how it goes.

It's usually how it goes. And I know I was going to be applying for a CISO job. And I ended up getting the CISO job at Temple because my CIO there had put on a document that went to the board saying he was the CISO and the board said, no, you don't. You can't do both. You need separation of duties. And at the time, I believe the chair of the audit and compliance committee was one of the more respected certified public accountants in Philadelphia. So you can't act out of line with a CPA on your board.

Right.

So I ended up getting the job there and going, "What the hell did I do to get this?" And not in a good way because I had no guidance, no experience. And guess what? I was responsible for security for a health system.

Yeah. You're not responsible for the Twitter account out there, Accidental CISO. It's kind of a funny play on people coming into the CISO role. No, I'm just kidding. Probably not you.

That's not me. Uh, he knows who I am.

Okay. Okay.

Apparently. He saw me at Circle CityCon a couple years ago, last year, and— but I've never met him.

Very nice.

But at the same time, I did a lot of studying, a lot of work, because it takes a lot of work to get to be in one of those roles, not just in security. So I ended up going back to grad school for not one but two master's degrees while doing all this, and also running a data center move for a year and a half.

Wow.

So I was pretty burned out by the time all that was done.

Just recapping, DOD, supporting pharma, software development, the university and health plan. So you've had a pretty diverse, well-rounded set of industry as well as technical and, and business roles, it sounds like.

Yes, I also had another role on there as well. I was also doing informatics for a small group out in New Jersey. Response that was responsible for all of monitoring all the kidney dialysis patients in the state as well.

Was this through your, your private, your contract company?

Yeah, one of my, one of, that was one of my contracts. I had that one for 6 years.

Okay, so, so how, how did you make the jump to IU Health and Indianapolis, Indiana in general, uh, From Temple?

So I was part of a national group of CIOs and CISOs that was discussing healthcare information security, and I got to make friends with the CIO of a health plan out in Pittsburgh.

Okay.

And what ended up happening is he got hired to be the CIO at IU Health. Got it. And 2 months 2 months after he got hired at IU Health, I got a call in the middle of the evening when I was helping my wife prepare dinner for the kids to ask about a job opportunity in the Midwest.

Got it.

So I said, "Sure, send it over to me." And I handed it over to my wife. I said, "Honey, I know this guy. Remember how I told you that my next job was going to be with someone I knew?" I said, here it is.

Yep.

And at the time I was dealing with a pretty toxic work environment. I was actually actively dealing with management that was fighting me on every security initiative I was trying to do. And I was just sick and tired of working in that type of environment. It was taking a toll on my life. Plus also the fact is I was commuting over an hour a day from New Jersey to go to work.

Yes. Well, welcome to Indiana. The traffic here is much better than the East Coast. That is one selling point amongst others.

Uh, 73 in Cherry Hill, New Jersey is a virtual parking lot at almost all times of the day. Right. So I was very happy to be here and that's how I ended up in Indiana is I got recruited and it's very very happy to come here and very happy to work with a team that actually wants to do things and doesn't blame other people for their problems, right?

So it sounds like— so basically, your, your career path to get to here now, and this is usually where I kind of try to pinpoint— it sounds like your whole theme is roll with the punches, keep your heads down, keep your head down, and, and grind through, and then you'll you'll figure out and be, you know, be good to people and they'll help you out and they'll help you get to where you need to be.

Absolutely. You've gotta be very good to other people. Always be willing to help them out. And I'll be honest, I helped out Mark Lancey whenever he asked me questions. He'd always pop me an email or two and it ended up turning into a job. Yep.

Okay. So at IU Health, how do you, What is the talent that you look for? How do you assess the talent that you're looking for in someone that you're looking to bring on board?

Yeah, and maybe sometimes in unconventional places. I know in cyber, infrastructure background is kind of the stereotype starting place, but sometimes, as diversity matters for a number of things, sometimes looking for talent outside of the traditional can add a lot of value to teams. So building on Teddy's question, what do you look for and what, how would you coach folks that are looking to get into cyber at a specific company like IU Health?

Honestly, what I look for is somebody who's really willing to put in the work to learn. I don't sit there and talk about I need this certification or this many years of experience because I'll be very clear about this. 2 years from now, what you know is not going to matter. Right. Yep.

That learning agility.

It's going to be legacy. If you have to be able to learn, you have to be able to pick up new things, and you have to show a willingness to be able to do so. I have very varied, varied experience on my team. Most of my team actually does not, did not previously come from cybersecurity. Okay. I have people that started as radiology techs. I have people that started off in project management. I have people that started off in theater. And I have people, some people, it's their first job in the industry. However, what it, what it comes down to, are you, are you will, are you willing to learn? Are you willing to put the effort in to learn? Are you willing to work well with others? Right. And are you going to be a good team member? Because I will not put up with entitled people, and I will not put up with bad attitudes.

Yeah, that health of a team and how people get along can make the difference of meeting the goals of a project and derailing that. So looking for that and cultivating that culture of togetherness is so important.

Absolutely. And again, based on previous experience, I will not put up with drama. I also understand, and this is something I learned in leadership classes when I was at LaSalle, it only takes 2 people to sink an organization. And this is coming from a professor I had that had been teaching leadership classes for 30-something years and who had actually brought in board members who had, one of whom reported directly to Jack Welch at GE to talk about the importance of building a good team. So I took a lot of notes. I listened to these people. And when I had the chance to build a good team like I have at IU Health, I jumped at the opportunity. And I'm very focused on engagement. I'm very focused on keeping the drama out and making sure the team is good. And again, I am People know me for this. I am very focused on making sure toxicity does not cause problems for my team or the organization because it only takes a few people and I don't want to have that with myself or my customers.

Right. No, that makes sense. Very important. So Mitch, uh, on this show we talk about, you know, within the cyber industry, there's a focus or overfocus on technology and cyber tools and how the newest tool can solve against the latest breach. But what we're trying to get at at this show is the human factor and how people and process are so paramount to solving some of these issues for the businesses that we support. So wanted to maybe talk through some examples of some of the big— one of the biggest business challenges you faced and how people and process specifically helped unearth the root cause and solution going forward?

So I'll talk about something that we put in, and that was for our patient privacy solution.

Okay.

And that's usually one of those areas I consider that one of those islands that usually a lot of people will not claim because it sits at the confluence of about 6 different areas of the business. And if you do not have everyone working together, you're not going to do well at it. I mean, it's just how it is, right? So one of the things that I did when I first got to IU Health is I got a hold of— I did my risk assessments and I realized we have an opportunity here. So I took advantage of the opportunity, but the way we did it is instead of taking a look at, oh, I have software let's fire all these people, which is the approach that many companies who market in the privacy monitoring space take, or the approach of let's scrutinize everyone and what they do. We took a multidisciplinary approach, and we actually went to our senior leadership team. We went to every single one of them and talked at their meetings and talked to their people and came up with a plan and a solution based upon these interviews with almost everyone in our organization that was at a high level, talk about what needed to be done and put together a process involving all of them. Not just one little isolated group, not just someone in a corner running a piece of software. We involved everyone that we could get our hands on. And had a good conversation with them. We talked— and we talked about it from the perspective of the mission and values of the organization, not in terms of computer security or privacy, but more how do we demonstrate to our patients that our work aligns with the mission and value of the organization, and how do we demonstrate purpose, excellence, team, and compassion in what we do. We do, right? And everything I do when I talk about it with my team is about mission and values. Purpose, excellence, team, and compassion actually came later than privacy, but at the same time when we talked about it, we talked about how do we meet the mission of demonstrating to IU Health patients that we care about their privacy and not just some fancy words that you say after a data breach. How do we show that we can build this into the organization and show on a continual basis, continual improvement, and that we care about our patients and we want to show that we value them. So that is the angle we took, not about security. And when I talk about security with my customers, I never talk about security. Right. I talk about alignment with the business, alignment with the mission and values. I had a talk last week where I talked about the purpose, excellence, team, and compassion with 400 people in our organization. However, at the major challenge of privacy was around framing and aligning to the core mission and values of the organization and the core value of how do we better protect and improve the health of patients in Indiana, right? And we were able to demonstrate that we would implement it in such a way that we would not impede efforts to improve quality and safety. We would not impede the advancements in research and work that we're doing. However, at the same time, we would work to improve patient privacy. And this was— it doesn't sound like a lot. It took me over a year to spearhead this effort to get it done. And I had to have a lot of help.

Yeah, no, that's a good point.

It was a team effort with privacy, human resources, nursing, medical staff, a lot of people. There's a lot of talking and a lot of taking people's information and concerns into consideration.

Yeah, no, that's a great story and example. The key points that I wrote down there that I think resonate with me are business engagement, organizational change management, and managing your stakeholders to be part of the problem, not something that you're inflicting a solution upon. And then the second thing, trust, patient trust, both gaining and maintaining, kind of all circling back to that. And then I think I also heard some elements of you've got to embed this in the business process and not take them down into the weeds of tech talk and the nuanced details, make it focused on their day, not behind the scenes on the tech staff that needs to handle some of the solutions that might support that journey that you're on.

Absolutely.

Very cool. So as you were building that, like you mentioned, it was not an overnight success. It took, like you said, over a year to get there. And my guess is you're probably It's a never-ending journey. You're still looking for ways to improve and enhance that. What were some of the upfront objections that you got early on as you were trying to win the support, hearts and minds of the folks that you needed their engagement?

People just wanted to understand what we were doing. And I know this sounds completely completely basic, but people needed to understand exactly what we were doing and why. And a lot of times in security, people hear all these terms, they hear about all these technologies, but they don't understand what the technologies actually do or why they matter. Right.

Yeah. One of my big pet peeves is when there's an action for a business member and they ask why, or you don't tell them why, and the answer is because of a breach or because I said so. And I think what I've learned in my career and as I consult with clients is be over, not overbearing, but overcommunicative in explaining the why from a business perspective. And a lot of times what I find out is once they understand, if you can get them there on understanding why, you will get their action and commitment much easier than, you know, using fear, uncertainty, and doubt or something to try to just say, "Because we have to, you know, it's privacy or it's compliance." That typically is a short-term approach that doesn't get the embedded cultural change that we're all hoping for.

Absolutely. And when I lead things off, I'll give you an example. Our former chief operating officer, Aaron Pritz was very focused on risk assessment scores. He goes, "I want to see everything you talk about with risk in this format." So, what I did as part of slide 2 on my presentation when I presented to the senior leadership team was those scores. I said, "These are the scores. This is what they tie to. This is why we're doing this. And this is why we need to do this." And it— one page. 4 scores got in, in his format, that's what sold.

Got it. So empirical data and being able to share, here's where we need to get based upon where we're at. Uh, the numbers made sense.

Exactly. Yep. You give him a quantitative analysis and his format, the way he wants it, he's going to pay attention to you and you're going to get funded. I mean, it's just how it is.

Right.

And also you have to take everyone in a— I mean, again, I can't express enough getting the consideration of others. And also you can't self-fod to our senior leadership team. We actually have a pretty much organizationally have said that that is something we frown upon. Very heavily.

You're living in a FUD-free zone?

Absolutely. That's good. You have to, because again, you can't make rash business decisions based on FUD because everything you do has a downstream effect. And larger of a company you have, the more people you're going to affect. And if you don't take this into consideration and are willing to work with others and you try and scare people, there's going to be some business process down the road that you're going to hit a landmine with that's going to— if it's managed the non-FUD way, it's a minor occurrence. If you manage it the FUD way, you'll blow your whole axle and wheel off and you're going to go nowhere.

Right, right. So somewhat related to winning engagement, Mitch, I know you're very active in the healthcare speaking community, and I think if you probably search on LinkedIn healthcare and cyber, you're probably gonna come up on the first page of results. How did you, obviously you came from Temple and then IU Health, so you're in that space, but for maybe some of the security folks out there or leaders that are not engaged externally, What, what advice or recommendations would you make to get more plugged into giving back to that community as well as sharing insights outside of your own bubble?

Well, I'll tell you a story about that.

Yeah.

When I first started at Temple, it was, we were not encouraged to participate in the local security community. Uh, the actual phrase that was used with several of my fellow team members was don't talk to outsiders. So I will tell you that the two weeks after my old boss retired, I showed up at the— for my first CISO Executive Network meeting in Philadelphia. Organization Bill Sigelin and Andy Land runs, really good organization. But you start small. I started talking to them. I started attending my local ISSA chapter meetings in Philadelphia, right? And I just started talking to people and that's how it started for me. It wasn't about trying to build some social media personality. I started off going to my local ISSA chapter meetings and speak. I spoke at the Philadelphia one in 2011. I spoke at a couple things before then, and then in 2015, a friend of mine, Anahi Santiago, she's not a SISO, a Christiana Care in Delaware, asked if I wanted to do some work with him in San Diego. And I got a phone call from someone that will fly out to San Diego, speak at this conference. I said, "It's March, it's cold." I'm in Philly, even if it's for a day, I'd like to see San Diego. And after that happened, I just started getting phone calls for different conferences and it kind of snowballed from there. Yeah.

The one thing I've appreciated about the cybersecurity community for the most part, like your example of the past, uh, not, not all leaders value it, but the, the thing I've really enjoyed about it is we're all fighting the same adversary and a lot of what we do in cybersecurity is not competitive across companies. So I enjoyed participating in like the healthcare ISAC and groups designed to just open up the doors of communication. And I think ultimately to your points, we get better together if we can help understand the technical solutions, the people solutions, and the process solutions holistically across organizations and improve together.

Absolutely. And I can tell you again, I can't say enough about what Bill Sigling's done with the CISO Executive Network. I think he put something great together and I was able to network with a bunch of people there.

Right.

I leveraged what I learned from them with my own security program. And was able to build significantly. And I leveraged my local ISSA chapter and also leveraged that and also what I learned from him. But again, I just didn't come in one day and decide, hey, I'm going to go speak at all these different conferences. No, I've been doing this probably about 8 years.

Right, right, right. So if you had— if you were talking to yourself 20 years ago, so think about people getting into security now? I mean, times have changed, technology has changed, organizations have changed in their adoption, but speaking to our audience of maybe newer to cybersecurity or not yet in security but interested, what would you recommend they do to better their posture for being ready to take on the challenges in cyber as well as be successful in getting jobs within companies today?

Also, like any certifications that you think would be good for starters, obviously like the main thing would be you know, that having the right mentality, but also, you know, what certifications would help them get to that point where they're, they're good to kind of begin a job or good to apply for a job?

So I'm going to say something you're not going to expect me to say. I actually recommend that people, instead of going for certifications initially, go for some good technical writing or and technical communications and corporate communications courses. Okay. Because there's a lot of people out there that I deal with who can't write and they can't communicate. And I'll be honest, I didn't know how to do a good PowerPoint presentation until I went to grad school and— when I got my MBA at Temple University and got myself schooled by a bunch of millennials. So, who were basically taking, saying, "I see your PowerPoint and raise you one, Prezi. Mine is awesome, yours sucks." So, I look at that as being very, very important because if you can't communicate what you're saying, you can't get in front of a room of people and you can't deal with the the C-suite, your room for advancement is not going to be good. You have to have fundamental understanding of good business communication, good writing skills, because again, if you want people to follow the security policy and you can't write, guess what? You're not going to have a policy.

Right. So definitely hearing— I was going to say, don't sell the soft skills short is what the advice you're You're really saying another set of acronym letters for a technical certification is a moot point if you can't do some of the business fundamentals that, that are learned over time and with different tactics.

Yes. And I'll also say one other thing with certifications. Keep with the, keep with the good ones. Keep with either the ISACA or ISC² ones.

Right.

And I would, I recommend those again, not because I'm going to discount any other certifications, but honestly, most HR departments don't even know what they are.

Right.

Yep.

All right. That's good advice.

So, so, I mean, all these other certifications are great, but I literally had to sit there and tell human resources what an OSCP was 3 years ago when a team member of mine got one.

See, I always talk to people like they know. I see what you're saying. I always talk to people like they know exactly what that is when I, when I bring up OSCP. And I, I agree. I get that. I get that same exact reaction. They don't understand what it is. You have to kind of repeat exactly the acronym 3 or 4 times and they always mix it up. OCSP, OSCP, all that. So I agree.

Yeah. So they'll know what the, so your average HR department A lot of them get their information from big firms like Mercer or Korn Ferry. Those firms know what a CISSP is, they know what the ISACA certs are, they know what a few of the other ones, even some of the SANS ones are. So you stick with the ones that people know. But more importantly, you focus on having those good business skills and those good communication skills. And I can't emphasize enough also having a basic knowledge of accounting. And the reason I say that is not because you have to be an accountant, but because a good chunk of the security controls that you use are actually based upon American Institute for Certified Public Accountants and the work they do. So when you have a conversation with people in finance, you have to explain control sets, you have to explain how this maps, and a lot of the work we do is very similar to work AICPA does when you do controls testing.

So that is incredibly valuable advice. I've never heard that before.

Yeah, it's— I actually did a master's thesis, part of a master's thesis on it, and realized most of the control sets map. So again, having that basic knowledge of accounting, having that basic knowledge of business, having that knowledge of communication and writing. And yes, having knowledge enough to get an SSCP, CISSP, or the ISAC asserts is pretty good. Also, you have to— I'm also going to say this much— understand encryption, because I've had to deal with security people that don't understand encryption.

Yeah, that's a good, good insight.

Yeah, because right now we got TLS 1.3 coming out, and I have to explain to people, yeah, all this technology you've put in place to do data loss prevention, guess what? It doesn't support TLS 1.3. It supports TLS 1.2. But guess who's on 1.3? Facebook. Which means you have no— which means you have no insight as to when someone uploads files to Facebook.

Right. So insights for your 21, 20-year-ago Mitch Parker and newbies that are coming in. I hear your comments on don't skip the soft skills, focus on the certifications that are renowned and solid core skill set. Any other tips to help people succeed?

I also say Avoid the toxicity, avoid the drama. If you see someone that's got a lot of skills, but they're an ass to other people, don't emulate their behavior. I made that mistake.

Got it. Wise advice. Well, Mitch, thanks so much for coming onto the show and helping others learn about you and your journey and kind of how you figured out ways to succeed in the people and process elements of cyber. Appreciate it and have a great week. Thank you so much.

Thank you so much. Thanks, Mitch.